Resource provisioned using kubectl in container

Classification:

attack

Tactic:

TA0002-execution

Technique:

T1610-deploy-container

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Goal

Detect the use of kubectl inside a container to provision new resources.

Strategy

This detection triggers when kubectl is executed with specific arguments related to provisioning resources, such as creating a namespace and running a pod.

Triage and response

  1. Identify the purpose of the container using tags, such as the image and service tags.
  2. Determine the resources involved, such as new containers.
  3. Initiate the incident response process.
  4. Remediate compromised resources and repair the root cause.

Requires Agent version 7.27 or greater